Server apparatus and method of preventing denial of service attacks, and computer program product

Abstract

A server apparatus receives a query message, calculates an identifying data based on an address and a query name containing in the query message, creates a response message containing the identifying data for requesting a redirect reply or a response message containing an answer to the query name, determines whether the query message is a redirect message and further determines whether the response message containing the answer is larger than a threshold value, and finally transmits either one of the response messages.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2006-291521, filed on Oct. 26, 2006; the entire contents of which are incorporated herein by reference.BACKGROUND OF THE INVENTION[0002]1. Field of the Invention[0003]The present invention relates to a server apparatus, a method, and a computer program product that can prevent denial-of-service attacks caused by transmitting a response packet that is amplified by a packet in which a query source is personated.[0004]2. Description of the Related Art[0005]Domain name system (DNS), one of backbone functions for the Internet, is a client-server database system for providing services based on data associated host names with internet protocol (IP) addresses. A DNS client transmits a query packet containing a specific domain name (such as a host name) to a server, and the server processes the query packet and transmit back to the clie...

AI Technical Summary

Benefits of technology

Effectively prevents DoS amplification attacks by reducing response message size and improving security in client-server communication systems without needing client-side support, thereby reducing development and implementation costs.

Problems solved by technology

As a data size of a response packet is larger than that of the query packet corresponding to itself, the attacker node can cause a severe damage with a relatively small band.

It means that the nodes on the network having a possibility to be attacked are restricted.

However, the authoritative server, which has to respond every queries regardless of which client is transmitted the query, can not employ the technique.

It means that the system does not effectively work until all of the existing clients on the Internet support the system used in the technique.

Images